Two new variants of the infamous IcedID malware have been spotted, but both lack certain distinctive features, making their purpose intriguing to security experts.
Proofpoint cybersecurity researchers reveal (opens in new tab) Since February, they’ve tracked two versions of IcedID, one called “Lite” and another called “Forked.”
Neither of them seem to have normal online banking fraud functionality and act as droppers for more sophisticated campaigns.
Stealth Malware Tactics According to Proofpoint, at least three different hacking groups have been observed using these two versions in seven campaigns since late last year. Apparently, these groups are using IcedID as a stepping stone to ransomware infections.
It’s unclear exactly why the attackers decided to remove IcedID’s unique features, but some reports suggest that removing “unnecessary” features makes it more stealthy and leaner, making it easier for cybercriminals to have been suggested to help incubate longer.
The way IcedID is delivered to victims is also different. In some cases, attackers distribute phishing emails with her Microsoft OneNote attachments. Otherwise, use Emotet.
The researchers say that the existence of two new variants does not mean that the original malware has fallen into disuse.
As of March 10, 2023, some attackers are still choosing to deploy what Proofpoint calls the “standard” variant. Researchers believe that even though Lite and Forked may gain some popularity this year, most attackers will still choose the standard variant.
IcedID is an older modular banking Trojan typically used to deploy stage 2 malware. So far, cybersecurity researchers have seen their use in countless campaigns, most of which involve access brokers gaining access to high-value networks and endpoints and later used to sell.
One such group is TA551, an actor with no concrete ties to any nation state. The group was seen selling access he obtained via IcedID last April.
websitebuildersnow
GIPHY App Key not set. Please check settings